I love Process Explorer for keeping track of more than just the high-level tasks you get in the Task Manager. But I constantly want to know which of those dozen services hosted in a single process under svchost is making my processor spike.

To the poster that recommended the PowerShell script: I tried it and it succesfully changed all my services. However, upon reboot an error box popped up and a restart was triggered. I had to restore with 'last good configuration'. Be careful.
–
user42670May 10 '10 at 7:38

While I don't know of easy way to do it directly, you can often infer it from the Process Explorer properties page for the svchost process. The Services tab on the process properties will tell you which services are hosted in that process. And the Threads tab will show you the threads and thread stacks running as well as their CPU usage. Often the Start Address on the thread will give an indication of the entry point DLL, and by extension the service, that's running on that thread. Other times you can look at the thread callstack and will see the module name in the call stack that tells you which piece of code is running.

Dmytro, where can I learn how to use your Service Disclosure tool? I downloaded and ran service_disclosure.exe on Windows 7. Briefly I saw a black command window open and close, but nothing more seemed to happen. This was disconcerting! I'd like to know what it did to my computer and how to properly use the tool.
–
DeveloperDanMar 31 '12 at 10:24

I don't know if this is still a question you want answers, but while troubleshooting a customer's svchost error, I learned that there is a command line for exactly this: "tasklist /svc" It gives a complete list of the processes running, with the process ID and the services each process is running. It doesn't give a processor usage, but you can close them one process at a time by process ID, and learn at least which group of services is clogging up your CPU.